Subprocessors
Last updated: 9 November 2026
A "subprocessor" is any third party we rely on to deliver the growyour.music service. Where a subprocessor processes personal data on our behalf we have signed their Data Processing Addendum (or accepted their standard terms), and international transfers are covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses as indicated below.
This list is kept in lockstep with our internal vendor register. If you spot something missing or stale, email privacy@growyour.music and we will correct it.
| Subprocessor | Purpose | Data types | Region | Transfer mechanism |
|---|---|---|---|---|
| Supabase (Supabase, Inc.) | Primary database, authentication storage, object storage for audio + user exports. | Account data, uploaded audio, transaction records, consent events, all relational data. | EU (Frankfurt) | Intra-EEA, no international transfer |
| Netlify (Netlify, Inc.) | Web hosting, scheduled functions, CDN. | Request metadata (IP, user-agent), access logs. | Global edge (US HQ) | SCCs + UK IDTA (Netlify DPA) |
| Creem (Armitage Labs OÜ) | Merchant of record for all purchases. Creem is the seller on the transaction, not a processor acting for us. Hosted checkout, subscription billing, invoicing, VAT/sales-tax registration and remittance, fraud screening, refunds and chargebacks. | Name, email, billing address, country/tax residency, tokenized card metadata (we never see card numbers), transaction + subscription history. | EU (Armitage Labs OÜ, Estonian registry code 16977866, Rotermanni 14, 10111 Tallinn, Estonia) | Intra-EEA, no international transfer |
| Paddle (Paddle.com Market Limited) | Merchant of record for purchases made before 12 October 2026. Paddle remains the seller for those transactions, including their invoices and any refund due on them; it carries no new traffic. | Name, email, billing address, country/tax residency, tokenized card metadata (we never see card numbers), transaction + subscription history. | UK (Paddle.com Market Limited, England no. 08172165, 30 Old Bailey, London EC4M 7AU); group controllers also in IE, US and CA | EU SCCs Module Two + UK Approved Addendum B.1.0 (Paddle DPA) |
| Stripe (Stripe Payments Europe, Ltd.) | Legacy payment processing and subscription billing from before the merchant-of-record model. Carries no new traffic; listed for the transaction records it still holds. Stripe Connect payouts were never enabled and the code has been removed. | Name, email, billing/postal address, card details (tokenized; we do not see card numbers), transaction history. | EEA (Ireland) for EU customers; US for others | SCCs + UK IDTA (Stripe DPA) |
| Resend (Resend, Inc.) | Transactional + marketing email delivery. | Email addresses, names, email content, delivery + bounce events. | US | SCCs + UK IDTA |
| PostHog (PostHog Inc.) | Product analytics, feature flags, session replay (sampled). | Anonymous visitor ID, authenticated user ID, page + feature events, device metadata. | EU (Frankfurt). Our instance is on the EU cloud. | Intra-EEA storage; SCCs + UK IDTA via PostHog DPA (signed 2026-05-20) |
| Meta Platforms, Inc. | Meta Marketing API for artist advertising campaigns (not currently offered; kept listed while past campaigns are reconciled). Meta Pixel: an artist can add their own Pixel ID to their Smart Link and Pre-Save pages. It loads only after the visitor accepts marketing cookies, and the events go to that artist's Meta account. growyour.music runs no Pixel of its own and sends no custom audiences or hashed contact data to Meta. | Campaign settings (targeting countries, age range, interest ids), the ad creative and copy, and the destination link. On pages with an artist Pixel, after marketing consent: page view and pre-save / click events, browser and device data, Meta cookie ids (_fbp, _fbc). | US | SCCs + UK IDTA |
| Google LLC (Google Ads + YouTube Ads + Analytics) | Google / YouTube advertising and Google Analytics 4 when the visitor has consented to analytics or marketing cookies. | Analytics events, ad conversion events, pseudonymous visitor IDs. | US / EU | SCCs + UK IDTA (Google Ads DPT) |
| Reddit, Inc. | Reddit Ads API and conversion tracking when the visitor has consented. | Ad conversion events, pseudonymous Reddit UID. | US | SCCs + UK IDTA |
| Spotify AB | Spotify OAuth for Presave campaigns; Spotify metadata fetch for Smart Paste. | Spotify user ID, access/refresh tokens, public profile (when user authorises). | EEA (Sweden) | Intra-EEA |
| SoundCloud Limited | SoundCloud OAuth for download-gate verification and oEmbed player. | SoundCloud user ID, access/refresh tokens, public profile. | EEA (Germany) / US | SCCs + UK IDTA |
| Exa (Metaphor Systems, Inc.) | Web search / link discovery for artist profile enrichment. | Search queries we send (artist name, label name). No end-user PII sent. | US | SCCs + UK IDTA |
| Groq, Inc. | LLM inference, first choice for the support chat and for AI text tools such as pitch and feedback drafting (fallbacks: NVIDIA, then Google Gemini). | Prompt text (may contain user-provided free-text content). | US | SCCs + UK IDTA |
| Google Gemini API | LLM inference: first choice for AI artist bios and image analysis; fallback for Gymmy (after Anthropic Claude), the support chat and AI text tools (after Groq). | Prompt text (may contain user-provided free-text content). | US / EU | SCCs + UK IDTA |
| Apify | Managed scraping runtime for Spotify metadata enrichment (public data only). | Public Spotify metadata. No personal data. | EEA (Czech Republic) | Intra-EEA |
| AcoustID / MusicBrainz (MetaBrainz Foundation) | Copyright + duplicate detection lookup against the public MusicBrainz database. | Audio fingerprint hash (not personal data; see Cookies page). | US non-profit (mirrored globally) | Publicly available database; anonymous API call |
| Cloudflare, Inc. | CDN, DDoS protection, DNS. | Request metadata (IP, user-agent), edge access logs. | Global edge | SCCs + UK IDTA |
| Freshdesk (Freshworks, Inc.) | Customer support ticketing (planned; enabled once paid-plan tier). | Email address, support message content. | EU (Frankfurt) | Intra-EEA |
| Sentry (Functional Software, Inc.) | Error tracking for server + client runtime exceptions. | Error messages, stack traces, deployment metadata. No deliberate PII; incidental user IDs possible. | US | SCCs + UK IDTA |
Change notifications
We will update this page whenever we add, replace, or remove a subprocessor that touches personal data. The "Last updated" date at the top of the page reflects the most recent change.